Back fortiguard.fortinet.com

FG IR 25 513

fortiguard.fortinet.com • June 17, 2026

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

Fortinet has observed this to be exploited in the wild.

FortiAppSec Cloud is NOT impacted by this vulnerability.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FortiWeb Vulnerabilities Exploited: Path Traversal and OS Command Injection Two vulnerabilities in FortiWeb have been identified, both exploited in the wild. The first, a relative path traversal vulnerability (CWE-23), allows unauthenticated attackers to execute administrative commands via crafted HTTP or HTTPS requests. The second, an OS command injection vulnerability (CWE-78), enables authenticated attackers to execute unauthorized code through crafted HTTP requests or CLI commands. Both vulnerabilities affect FortiWeb systems but do not impact FortiAppSec Cloud. Fortinet recommends disabling HTTP/HTTPS for internet-facing interfaces as a temporary mitigation until upgrades can be performed. Customers are advised to review their configurations and logs for unauthorized changes. Immediate action is necessary to prevent exploitation. 73

Extracted Entities

FG IR 25 513

The full story

Extracted Entities

CWE Weaknesses (1)

MITRE ATT&CK (1)

Vulnerabilities (2)